0f9a0d047ba06fba12da4d654059c4c0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

0f9a0d047ba06fba12da4d654059c4c0N.exe
Size

242KB
MD5

0f9a0d047ba06fba12da4d654059c4c0
SHA1

e2c8af974737afe2207bf0fbc32a23fb721d5de0
SHA256

4ff7521f324b50c2b93cf2cb74348aa81c8b058564e27ad8503705f916672d33
SHA512

8d5fd6da4af61d8519d3c0a21c360d1fe843e6b9b17c2712097c3bcd900d246be88798bd750fab2d59264e9ad8ae0005cbef10b9958500c640da3d9efabcf7c8
SSDEEP

6144:C5279l9NxFtrqHDNDeaD/3g9Slx/fHDAATPAtWg30:CEPx+XBoWg3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f9a0d047ba06fba12da4d654059c4c0N.exe

Files

0f9a0d047ba06fba12da4d654059c4c0N.exe
.exe windows:6 windows x86 arch:x86

758ab9a83db4b5ef9c3694b454eb2621

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mcbuilder.pdb

Imports

advapi32

RegCloseKey
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegGetValueW
AdjustTokenPrivileges
PrivilegeCheck
LookupPrivilegeValueW
OpenProcessToken
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegFlushKey
RegEnumValueW
RegOpenKeyExW

kernel32

GetLastError
GetProcAddress
LoadLibraryW
EnumUILanguagesW
HeapAlloc
GetProcessHeap
GetSystemTimeAsFileTime
GetFileTime
MoveFileExW
LoadLibraryExW
GetVersionExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetSystemDirectoryW
IsValidLocale
CreateDirectoryW
GetFileAttributesW
RemoveDirectoryW
CreateMutexW
WaitForSingleObject
GetSystemWindowsDirectoryW
WriteFile
FlushFileBuffers
FreeLibrary
FlushViewOfFile
LocalFree
GetCurrentThread
GetDiskFreeSpaceExW
DeviceIoControl
GlobalMemoryStatusEx
ExpandEnvironmentStringsW
GetFileAttributesExW
SetFileAttributesW
CreateFileW
GetFileSizeEx
ReadFile
HeapFree
OpenFileMappingW
MapViewOfFile
SetLastError
UnmapViewOfFile
ReleaseMutex
CloseHandle
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
SystemTimeToFileTime
Sleep
InterlockedExchange
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
FreeResource
GetSystemPreferredUILanguages
GetSystemTime
GetSystemDefaultUILanguage
LCIDToLocaleName
GetProductInfo
CreateFileMappingW

msvcrt

bsearch
towlower
printf
_wcsupr
_wgetenv
wcsncmp
wcsrchr
_controlfp
_except_handler4_common
?terminate@@YAXXZ
_onexit
_lock
__dllonexit
_unlock
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
malloc
_callnewh
free
towupper
_wfopen_s
fgetws
fclose
??0exception@@QAE@XZ
_wcsicmp
_wcsnicmp
_wcsupr_s
__CxxFrameHandler3
wcsstr
swscanf
_CxxThrowException
wcstol
wcstoul
wcschr
memset
memcpy
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
memmove_s
memcpy_s
_vsnwprintf

ntdll

RtlReAllocateHeap
EtwEventUnregister
RtlGetSystemPreferredUILanguages
EtwEventEnabled
EtwEventWrite
RtlExpandEnvironmentStrings
RtlAllocateHeap
RtlFreeHeap
RtlInitUnicodeString
RtlHashUnicodeString
NtUnmapViewOfSection
RtlNtStatusToDosError
NtMapViewOfSection
RtlUnicodeStringToInteger
EtwEventRegister

netapi32

NetGetJoinInformation
NetApiBufferFree

Sections

.text
Size: 182KB - Virtual size: 182KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGELK
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

758ab9a83db4b5ef9c3694b454eb2621

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

ntdll

netapi32

Sections

.text Size: 182KB - Virtual size: 182KB

PAGELK Size: 5KB - Virtual size: 5KB

.data Size: 15KB - Virtual size: 17KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 36KB - Virtual size: 37KB

.text
Size: 182KB - Virtual size: 182KB

PAGELK
Size: 5KB - Virtual size: 5KB

.data
Size: 15KB - Virtual size: 17KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 36KB - Virtual size: 37KB